Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

"Oracle native authentication protocols are typical challenge-response protocols. After some negotiation the client sends the username. If the user exists the server sends an encrypted key. The client uses the key to encrypt the user's password and sends it to the server. One of the protocols is documented quite well in [1.]. On reading that description it is quite obvious that the protocol is vulnerable against the off-line brute force attack. Oracle changed the algorithmin 9i and changed it again in 10g. If we use the OCI driver, our programs will use these newer protocols, but thin drivers use the older version, thus implementing an off-line brute forcer is notabsolutely pointless (if you can sniff the connection you can conduct several other attacks of course). The servers and the clients support the older version of the protocol, thus it is worth a research whether downgrade attack is possible.

This article describes four versions of the Oracle native authentication. These information are based on [3.]. This description is shorter than [3.] and just emphasizes those differences that couldbe important in a downgrade attack againts the (SEEMS TO BE stronger) newer authentication protocols.

We do not disclose the details of the downgrading. In the Downgrading chapter you can find screenshots about a successful attack to prove that downgrading is possible."

PFCLTraining is a set of expert training classes for you, aimed at teaching how to audit your own Oracle database,
design audit trails, secure code in PL/SQL and secure and lock down your Oracle database.

For any more information about our Oracle Security services or or our products to help you secure your Oracle database or our
expert Oracle Security training please call us now on +44 7759 277220 or contact us by email at info@petefinnigan.com